# Agents match, reconcile, and flag; your controllers keep every sign-off

> Invoice exception processing, spend requests, month-end close, and vendor payment-change checks as governed agent workflows — approvals logged, exceptions routed to humans.

- Canonical: https://www.brahmalabs.io/use-cases/finance/
- Department: Finance & Accounting
- All departments: https://www.brahmalabs.io/use-cases/

## The department that gets audited

AP and controllership run on volume nobody staffed for. Invoices land from a dozen systems — the ERP, procurement portals, the AP inbox. Three-way matching means toggling between the ERP and a spreadsheet. The close checklist records that a step happened, not who did it or where the evidence lives. And the most dangerous message in the inbox is a vendor "updating" bank details — payment-diversion fraud targets that exact workflow because the change looks routine and the verification step is informal.

Generic automation handles the happy path. Finance is judged on the exceptions, and on whether it can prove — months later — who approved what.

## What changes with governed agents

Agents take the reading and matching; the deciding stays where it is. Extraction, record lookup, and discrepancy flagging run as workflow nodes. Records live in Data Tables inside the platform or in your ERP through an integration — the agent reads both the same way, and a match is a proposal, not a posting.

The control layer is the point. Approvals above a threshold require N-of-M consensus — two of three named approvers, not one tired one — with SLA timeouts and escalation chains so nothing rots in a queue. Every proposal, approval, rejection, and escalation lands in an append-only audit log spanning eight event categories. Evidence attaches as versioned artifacts: when auditors ask for support, you send a URL, not a zip file. Guardrails and PII redaction run before any model call, so vendor banking data and employee details are filtered before inference. Spend ceilings cap what any run can cost.

Runs are durable. A close step that pauses Tuesday for a controller's sign-off resumes Thursday when it arrives — state intact, no re-run, no babysitting.

## What stays human

Payment release. Every change to vendor banking details, verified out-of-band by a person — the agent only assembles the evidence. Threshold sign-offs. Judgment on real exceptions: whether a price variance is a negotiated change or an entry error. An agent on this platform cannot approve its own proposal; the human gate is a node in the workflow, not a policy document. In finance, the log that proves it is half the value.

## The workflows

### 1. Invoice intake and exception matching

- **Trigger:** An invoice lands as a webhook from your ERP or procurement system, or arrives on the AP email inbox as structured text.
- **Flow:** An agent extracts vendor, PO number, line items, and totals, then matches them against open records in a Data Table or your ERP via an integration; mismatches are flagged with the specific discrepancy.
- **Human gate:** Matches queue for an AP approver; anything above threshold needs N-of-M consensus with SLA escalation; exceptions land in a reviewer inbox with the delta named.
- **Output:** A matched or exception row in the invoice table, plus an audit-log entry for the agent's proposal and every human decision.

### 2. Spend requests with an audit-ready trail

- **Trigger:** An employee posts a spend request in a Slack channel, or the request lands as a webhook from your expense tool.
- **Flow:** The agent checks the request against budget rows in a Data Table, pulls the vendor's prior spend, and assembles an approval packet with amount, category, and remaining budget.
- **Human gate:** Approvers decide from the reviewer inbox through a dynamic approval form; above-threshold requests require N-of-M consensus, with SLA timeouts escalating stalled decisions.
- **Output:** An approved or rejected request row, the packet stored as a versioned artifact, and an append-only audit entry per decision.

### 3. Month-end close as a durable run

- **Trigger:** A monthly schedule starts the close run; the overlap policy prevents a second close from starting mid-flight.
- **Flow:** Each close step is a node: reconciliations pulled through integrations, checklist state tracked in a Data Table, evidence attached as versioned artifacts as steps complete.
- **Human gate:** The controller signs off each gated step; the run parks durably — for days if needed — until the sign-off lands.
- **Output:** A completed close run with every step evidenced in the audit log and artifacts auditors reach by URL.

### 4. Vendor payment-change verification

- **Trigger:** A vendor emails new bank details, or a change request hits the vendor-master webhook.
- **Flow:** The agent diffs the request against the vendor record, checks the sender against known contacts, and compiles a verification packet — it cannot apply the change itself.
- **Human gate:** Mandatory gate: an AP lead verifies out-of-band before approving; high-value vendors require N-of-M consensus. This is the classic fraud vector — no exceptions.
- **Output:** The change applied to the vendor record only after approval, with the verification packet kept as a versioned artifact.

## Platform pieces this leans on

- Data Tables
- N-of-M approvals with SLA escalation
- Append-only audit log
- Versioned artifacts
- PII guardrails
- Durable runs
- Integrations across 300+ providers
- Channel agents (email/Slack)

---

Brahmalabs — the AgentOps platform for production AI agents. https://www.brahmalabs.io